Deception Archives

Tech Optimizer

September 1, 2026

Fake Microsoft Security Scan Tells You to Remove Antivirus—Then Scammers Ask for Remote Access

A new web-based scam is using counterfeit Microsoft-branded security scans to deceive users into uninstalling their antivirus software. The scam websites conduct fake inspections, reporting false security failures and claiming third-party antivirus products are unsupported by Windows. They gather browser information to create customized-looking scan reports and aim to mislead victims into a fraudulent refund process. Investigators have identified 11 related scam sites under the name SysScan, which present themselves as legitimate Microsoft security checks. The scam does not involve file downloads but relies on convincing websites, fabricated security scores, and personal information forms. The scan results are hard-coded, and the security score is limited to a range between 13 and 30 out of 100. The scams instruct users to uninstall antivirus software, which is misleading since Windows does not cease support for third-party antivirus solutions. The scam sites request extensive personal information, including names, addresses, phone numbers, and banking details, and redirect victims to a page claiming a refund manager will call shortly. This process allows scammers to gain remote access to victims' computers. Indicators of compromise include specific IP addresses and domains associated with the scam.

Tech Optimizer

August 29, 2026

What the Tech: Antivirus Scams

A viewer reported receiving a popup on her smartphone claiming her system was infected with 120 viruses, which is a scam designed to provoke panic and encourage the download of a free antivirus app called “Total Cleaner.” This popup aims to trick users into downloading an app that may have hidden costs, initiate expensive subscriptions, or direct them to phishing sites. The app “Total Cleaner” has fake reviews, hidden costs after installation, and privacy concerns regarding personal data collection. Most modern smartphones do not require traditional antivirus programs, and such popups are advertisements from deceptive sources. To protect against these alerts, users should close the tab immediately, keep their devices updated, and only download apps from official app stores after thorough research.

Tech Optimizer

August 27, 2026

Scammers Impersonate Microsoft to Push Fake Security Scans and Refund Fraud

A network of fraudulent websites, branded as SysScan, has been discovered, which falsely claims to evaluate antivirus software effectiveness through deceptive security scans. These sites manipulate users into uninstalling legitimate antivirus products and disclosing sensitive personal and banking information. Eleven distinct domains associated with SysScan have been identified, all hosted on a single server. The fraudulent scans generate misleading results based on static findings rather than actual system assessments, and users are coerced into believing their computers are at risk. The scams misrepresent normal browser behaviors as security threats and instruct victims to uninstall their antivirus software, compromising their defenses. The operation targets both individual and business users, collecting extensive personal information and utilizing remote-access tools. The data submitted is sent to Telegram via its bot API. Users are advised to disconnect from the internet and secure their devices if they suspect they have been compromised. Indicators of compromise include specific IP addresses and domains associated with the scam.

Tech Optimizer

August 26, 2026

Catch Of The Week: The ‘Security Scan’ That Wants You Defenseless

Researchers at Malwarebytes have identified a network of deceptive websites posing as a service called “SysScan,” which pretends to conduct Microsoft security checkups. Users encounter these sites through search results, browser hijacking pop-ups, or unsolicited emails. The sites use Microsoft branding and a fake progress bar to create the illusion of a scan, but they only collect harmless data like operating system and location, which are then manipulated into alarming fake alerts. The fabricated security score is predetermined and does not reflect the user's actual security status. The scam misleads users into believing that Windows no longer supports third-party antivirus software, prompting them to uninstall their protections, which increases their vulnerability. Users are then asked to provide personal and banking information through a form that sends data via a Telegram bot. Eleven fraudulent sites have been traced back to a single server. Indicators of the scam include requests to disable antivirus software, installation of remote-access software, and solicitation of sensitive information. Microsoft does not initiate cold calls or scan computers through web pages. If someone has engaged with the scam, they should disconnect from the internet, uninstall any remote-access tools, reinstall antivirus software, and report the incident to authorities.

Tech Optimizer

August 24, 2026

Fake Microsoft security scans trick victims into uninstalling their antivirus

A surge of fraudulent websites claiming to verify antivirus software functionality has emerged, using the name SysScan and misleadingly asserting that Windows no longer supports third-party antivirus solutions. These sites conduct fake security scans, gather personal information, and set up a refund scam. Eleven such websites were found hosted on a single server, executing similar deceptive tactics. They can access basic browser data but cannot conduct genuine security scans. Microsoft continues to support third-party antivirus software, and legitimate refund processes do not require uninstalling security tools. The scams instruct users to remove their antivirus software to facilitate further manipulation and to collect information about the antivirus in use. The customer information forms collect extensive personal data and are designed to send this information to a Telegram bot API. Victims are promised a refund call after submitting their information, which is part of the scam's manipulation. Signs of such scams include claims of deep problems with the computer, consistently negative diagnostic results, requests to uninstall antivirus software, and demands for banking information. If affected, victims should disconnect from the internet, remove remote-access tools, and contact their bank. The hosting IP address for these sites is 157.230.180.90, with multiple associated domains listed.

Tech Optimizer

August 14, 2026

‘This one just needs a script’: Researchers find ultimate Windows kill switch which can disable antivirus with almost no user interaction

Researchers have identified a significant vulnerability in consumer DDR4 and DDR5 memory modules, known as the “Download more RAM” flaw, which allows attackers to bypass advanced Windows security features, including Virtualization-Based Security (VBS) and Hypervisor Code Integrity (HVCI). This vulnerability enables the manipulation of configuration reports from RAM, misleading the system about its actual memory capacity, which can disable antivirus protections and allow the reintroduction of outdated drivers. The exploit can be executed via a single-click script, leading to security failures. Microsoft has released a patch for CVE‑2026‑23670 to enhance memory write protection against such exploits.

Winsage

August 1, 2026

Microsoft Issues Hotel Wi-Fi Warning For Windows PC Users

Microsoft has issued a warning to organizations regarding the risks associated with public and hospitality network infrastructures, citing a new hacking threat from Russian cyber actors targeting travelers for malware distribution and credential theft. This warning follows the identification of a global campaign named CaptiveCrunch, linked to Storm-2945, which has been targeting corporate travelers since early May by exploiting compromised guest networks. Attackers are manipulating hospitality networks to facilitate credential theft and malware delivery, using tactics such as redirecting network traffic to counterfeit sign-in pages. The campaign affects both Windows and Android devices and employs techniques that include presenting fake verification checks and software updates. Some victims have been misled into participating in Microsoft’s legitimate device-code authentication process, allowing attackers to gain access to accounts without stealing passwords. Microsoft advises travelers to treat guest networks as untrusted and recommends using mobile hotspots, avoiding updates through captive portals, and enhancing security measures. Malicious tools identified include the Windows remote-access trojan (RAT) named CornFlake, which can steal credentials, record keystrokes, and hijack audio and video capabilities.

AppWizard

July 23, 2026

Active Exploitation Alert: Fake Bahrain Alert App Deploys Advanced Android Surveillance Malware Targeting Gulf Region Users

A cyber-espionage campaign has been identified involving a counterfeit Bahrain Alert Android application designed to surveil individuals in Bahrain and the Gulf region. The app masquerades as an official civil defense tool and employs social engineering tactics to compromise Android devices, extract sensitive data, and maintain remote access. It targets high-value individuals such as activists and journalists, particularly during civil unrest and missile alerts, leveraging trusted government branding to increase infection rates. The malware features a complex, multi-stage architecture with advanced evasion techniques and is distributed through phishing links and malicious websites. It initiates a four-stage infection process, ultimately installing a remote access trojan (RAT) that enables covert surveillance and encrypted communications. The malware can monitor device activity, capture credentials, and intercept communications, while also employing mechanisms to avoid detection and maintain persistence. The campaign primarily targets Bahraini citizens, exploiting fear during crises to encourage app installation. Although there are indications of Russian-speaking developers involved, there is no definitive attribution to a specific nation-state or APT group. Mitigation strategies include monitoring for suspicious app installations, user education on verifying app authenticity, and blocking known malicious domains.

BetaBeacon

July 20, 2026

Monday’s Android iOS app deals and freebies: LIMBO, Super Dark Deception, WINCH IT OUT, Box Head, more

Today's Android app price drops include titles like WINCH IT OUT, LIMBO, Super Dark Deception, Undead Slayer: Offline Premium, Paign - RPG, and Box Head: Roguelike Premium.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.